From 3b125dbe7110fc4ff3e0ae5e0de89c6eb5f8d998 Mon Sep 17 00:00:00 2001
From: konsti <konstin@mailbox.org>
Date: Tue, 13 May 2025 04:29:26 +0200
Subject: [PATCH] Avoid panics for cannot-be-a-base URLs (#13406)

Following #13376, avoid `.unwrap()` on `Url::path_segments()`.

I also added some unwrap-safety comments.
---
 crates/uv-cache-key/src/canonical_url.rs | 3 +++
 crates/uv-python/src/downloads.rs        | 6 ++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/crates/uv-cache-key/src/canonical_url.rs b/crates/uv-cache-key/src/canonical_url.rs
index e0487fa7f..d46ccf21d 100644
--- a/crates/uv-cache-key/src/canonical_url.rs
+++ b/crates/uv-cache-key/src/canonical_url.rs
@@ -65,6 +65,8 @@ impl CanonicalUrl {
                 .is_some_and(|ext| ext.eq_ignore_ascii_case("git"));
             if needs_chopping {
                 let last = {
+                    // Unwrap safety: We checked `url.cannot_be_a_base()`, and `url.path()` having
+                    // an extension implies at least one segment.
                     let last = url.path_segments().unwrap().next_back().unwrap();
                     last[..last.len() - 4].to_owned()
                 };
@@ -74,6 +76,7 @@ impl CanonicalUrl {
 
         // Decode any percent-encoded characters in the path.
         if memchr::memchr(b'%', url.path().as_bytes()).is_some() {
+            // Unwrap safety: We checked `url.cannot_be_a_base()`.
             let decoded = url
                 .path_segments()
                 .unwrap()
diff --git a/crates/uv-python/src/downloads.rs b/crates/uv-python/src/downloads.rs
index fb7a3c067..d54b16de4 100644
--- a/crates/uv-python/src/downloads.rs
+++ b/crates/uv-python/src/downloads.rs
@@ -66,6 +66,8 @@ pub enum Error {
     },
     #[error("Invalid download URL")]
     InvalidUrl(#[from] url::ParseError),
+    #[error("Invalid download URL: {0}")]
+    InvalidUrlFormat(Url),
     #[error("Invalid path in file URL: `{0}`")]
     InvalidFileUrl(String),
     #[error("Failed to create download directory")]
@@ -643,9 +645,9 @@ impl ManagedPythonDownload {
         // decodes to.
         let filename = url
             .path_segments()
-            .unwrap()
+            .ok_or_else(|| Error::InvalidUrlFormat(url.clone()))?
             .next_back()
-            .unwrap()
+            .ok_or_else(|| Error::InvalidUrlFormat(url.clone()))?
             .replace("%2B", "-");
         debug_assert!(
             filename